win32u.dll exists in Win10 (dont know about Win 8)

Address 07FFEFF4E5178h holds the address to the real function NtUserShowWindow in win32u.dll

In such case it all depends at which point you expect to find a hook, here there are 3 places where a hook might be applied.
1. at address 00007FFEFF490B00 in user32.dll
2. at address 00007FFEFF4E5178 in user32.dll
3. at address 00007FFEFE271B50 in win32u.dll

Sorry, please upload it somewhere else.

Thank you, I have to check again


http://www.mediafire.com/file/h55ajo90cor6o78/Check.rar

@Mahmoudnia

By the way, one thing that may confuse you, is that, you are seing user32.NtUserShowWindow instead of user32.ShowWindow in the debugger because you have loaded the debugging symbols of the module user32.dll.

The exported function name is obviously ShowWindow but the internal name of the function included in the debugg symbols is NtUserShowWindow which is what you see.

Remove the debug symbols for user32.dll cached on your pc and then try Ctrl+G again.